logstash/logstash — pull request #375 by Spredzy (2013-02-27 14:15:48+00:00)
Title: Possibility to use kv filter against a previously groked variable

Let's write a filter section that looks like this

grok {
type => 'demo'
pattern => "%{URIPATH:mypath}%{URIPARAM:myparams}"
}
kv {
type => 'demo'
fields => ???
field_splut => "&?"
}

As of today if I want to use the kv filter against the `myparams` variable I got from grokking I can't. kv needs to received on of the top-level fields (ie. @source, @tags, @fields, etc...)

This pull request aims to make the preceding possible, with the following snippet

grok {
type => 'demo'
pattern => "%{URIPATH:mypath}%{URIPARAM:myparams}"
}
kv {
type => 'demo'
fields => ["@fields.myparams"]
field_split => "&?"
}

I hope this make sense,